Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,136 total in npm · sorted newest first- Jun 29, 2022
Malicious code in horizon_dev (npm)
- Jun 29, 2022
Malware in horizon_dev
1 compromised version
- Jun 27, 2022
Malicious code in discordselfbotv16 (npm)
- Jun 27, 2022
Malicious code in discordselfbotv15 (npm)
- Jun 27, 2022
Malicious code in discordjs-selfbot-v17 (npm)
- Jun 27, 2022
Malicious code in discorddependency (npm)
- Jun 27, 2022
Malware in discordjs-selfbot-v17
1 compromised version
- Jun 27, 2022
Malware in discordselfbotv15
1 compromised version
- Jun 27, 2022
Malware in discordselfbotv16
1 compromised version
- Jun 27, 2022
Malware in discorddependency
1 compromised version
- Jun 22, 2022
Malicious code in bumblogger (npm)
- Jun 22, 2022
Malware in bumblogger
1 compromised version
- Jun 22, 2022
Malicious code in @amplify-components/amplify-table (npm)
- Jun 22, 2022
Malware in @amplify-components/amplify-table
1 compromised version
- Jun 22, 2022
Malicious code in euscp (npm)
- Jun 22, 2022
Malware in euscp
1 compromised version
- Jun 22, 2022
Malicious code in elementor.developers (npm)
- Jun 22, 2022
Malware in elementor.developers
1 compromised version
- Jun 22, 2022
Malicious code in slg-vue-components (npm)
- Jun 22, 2022
Malicious code in slg-shared-utils (npm)
- Jun 22, 2022
Malware in slg-vue-components
1 compromised version
- Jun 22, 2022
Malware in slg-shared-utils
1 compromised version
- Jun 22, 2022
Malicious code in wad-workshop-starter (npm)
- Jun 22, 2022
Malicious code in solid-completions (npm)
- Jun 22, 2022
Malicious code in smoooth-merchant (npm)
- Jun 22, 2022
Malicious code in shoppedemo (npm)
- Jun 22, 2022
Malicious code in osmosis-frontend (npm)
- Jun 22, 2022
Malicious code in katt-player (npm)
- Jun 22, 2022
Malicious code in jobcoin (npm)
- Jun 22, 2022
Malicious code in front-channel-template (npm)
- Jun 22, 2022
Malicious code in ethmoji-js-demo (npm)
- Jun 22, 2022
Malicious code in dash-generator-test-component-standard (npm)
- Jun 22, 2022
Malicious code in 1uphealth-demo-web-app (npm)
- Jun 22, 2022
Malicious code in consideration-deploy-bot (npm)
- Jun 22, 2022
Malicious code in bakabaka0010 (npm)
- Jun 22, 2022
Malware in front-channel-template
1 compromised version
- Jun 22, 2022
Malware in consideration-deploy-bot
1 compromised version
- Jun 22, 2022
Malware in ethmoji-js-demo
1 compromised version
- Jun 22, 2022
Malware in jobcoin
1 compromised version
- Jun 22, 2022
Malware in bakabaka0010
1 compromised version
- Jun 22, 2022
Malware in osmosis-frontend
1 compromised version
- Jun 22, 2022
Malware in dash-generator-test-component-standard
1 compromised version
- Jun 22, 2022
Malware in smoooth-merchant
1 compromised version
- Jun 22, 2022
Malware in 1uphealth-demo-web-app
1 compromised version
- Jun 22, 2022
Malware in shoppedemo
1 compromised version
- Jun 22, 2022
Malware in katt-player
1 compromised version
- Jun 22, 2022
Malware in wad-workshop-starter
1 compromised version
- Jun 22, 2022
Malware in solid-completions
1 compromised version
- Jun 22, 2022
Malware in omm-frontend
1 compromised version
- Jun 22, 2022
Malicious code in material-ui-plugin-theme-provider-cache (npm)
Page 6439 of 6,643